A corporation is deploying IBNS 2.0 and wants to enforce a session timeout and reauthentication for all users after 8 hours. They also want to enforce posture assessment for devices that are not compliant. What is the best way to implement this using C3PL?

Create a separate VLAN for non-compliant devices and use static ACLs to enforce posture.

Configure a policy map that includes session timeout and reauthentication actions, and use a parameter map to define the posture assessment settings.

Use a global parameter map to set the session timeout and reauthentication for all ports, and enable posture assessment globally.

Configure the session timeout and reauthentication on the RADIUS server only, and rely on the switch to enforce them.

A network administrator is troubleshooting an IBNS 2.0 deployment where users are failing 802.1X authentication. The RADIUS server logs show that authentication requests are being received but are timing out. What is the most likely cause and what should be checked first?

Check the RADIUS server's shared secret and ensure it matches the switch configuration.

Check the client's supplicant configuration for incorrect username or password.

Check the switch's RADIUS server configuration for correct IP address and UDP ports.

Check the switch's VLAN assignment for the port.

A company is deploying IBNS 2.0 and wants to enforce different access policies for users based on their role. They have three roles: admin, employee, and guest. They want to assign different VLANs and ACLs to each role. What is the most efficient way to implement this using C3PL?

Configure the VLAN and ACL assignments on the RADIUS server and do not use C3PL on the switch.

Create a separate policy map for each role and apply them to different ports.

Use a single class map that matches all users and assign a common VLAN and ACL.

Create a single policy map with multiple class maps, each matching on a specific role attribute, and assign the appropriate VLAN and ACL in each class.

A hospital is implementing IBNS 2.0 and wants to enforce a policy that requires reauthentication every 12 hours for all users. They also want to apply a dACL that restricts access to patient records for non-clinical staff. What is the best way to implement this?

Create a separate VLAN for non-clinical staff and use a static ACL to restrict access.

Configure the reauthentication timer on the RADIUS server and apply a static ACL on the switch.

Use a parameter map to set the reauthentication timer and apply it globally, and use a static ACL for access control.

Create a policy map that includes a reauthentication action and references a dACL returned by the RADIUS server.

A university is deploying IBNS 2.0 for its dormitory network. The network team wants to automatically authenticate gaming consoles and smart TVs that do not support 802.1X, while still requiring 802.1X for laptops. They plan to use a C3PL policy with a class map that matches on device type. Which authentication method should be configured as the fallback in the policy map for the class matching these non-802.1X devices?

MAC Authentication Bypass (MAB)

CCIE Security

Domain 4Objective 18

4.18 Cisco IBNS 2.0 (C3PL) for Authentication, Access Control, and User Policy Enforcement CCIE-SECURITY Practice Questions (Page 6)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

25%of the exam

Questions 26–30

26application · medium
A corporation is deploying IBNS 2.0 and wants to enforce a session timeout and reauthentication for all users after 8 hours. They also want to enforce posture assessment for devices that are not compliant. What is the best way to implement this using C3PL?
Select an answer first
27application · medium
A network administrator is troubleshooting an IBNS 2.0 deployment where users are failing 802.1X authentication. The RADIUS server logs show that authentication requests are being received but are timing out. What is the most likely cause and what should be checked first?
Select an answer first
28application · medium
A company is deploying IBNS 2.0 and wants to enforce different access policies for users based on their role. They have three roles: admin, employee, and guest. They want to assign different VLANs and ACLs to each role. What is the most efficient way to implement this using C3PL?
Select an answer first
29application · medium
A hospital is implementing IBNS 2.0 and wants to enforce a policy that requires reauthentication every 12 hours for all users. They also want to apply a dACL that restricts access to patient records for non-clinical staff. What is the best way to implement this?
Select an answer first
30application · medium
A university is deploying IBNS 2.0 for its dormitory network. The network team wants to automatically authenticate gaming consoles and smart TVs that do not support 802.1X, while still requiring 802.1X for laptops. They plan to use a C3PL policy with a class map that matches on device type. Which authentication method should be configured as the fallback in the policy map for the class matching these non-802.1X devices?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.